CryptoWall (Cryptodefense)

malware1

http://kuai.xunlei.com/d/XLDoFLoARsIpVAQAa41
infected

VT: https://www.virustotal.com/en/fi ... nalysis/1412022040/

https://barracudalabs.com/2014/0 ... vertising-campaign/

skyboybone

金山

hdx2012

微点双击杀

欧阳宣

"E:\test\virus\ba92a58928b82ba662e7abb4ff4014a9\ba92a58928b82ba662e7abb4ff4014a9"        "Artemis!BA92A58928B8"

Mr_Knight

b573684723

好压火绒扫描MISS

EAVKILL

yicun

Trojan.Injector.BAB
C:\Sandbox\Eric\DefaultBox\user\current\Downloads\ba92a58928b82ba662e7abb4ff4014a9\ba92a58928b82ba662e7abb4ff4014a9

墨家小子

这么酸爽的 一定试试


2014/9/30 13:27:24,C:\Windows\explorer.exe,53,Allowed ;启动一个应用程序 ("C:\Users\250

\Desktop\ba92a58928b82ba662e7abb4ff4014a9\ba92a58928b82ba662e7abb4ff4014a9.exe" )

2014/9/30 13:27:40,C:\Users\250\Desktop

\ba92a58928b82ba662e7abb4ff4014a9\ba92a58928b82ba662e7abb4ff4014a9.exe,53,Allowed ;启动一个

应用程序 ("C:\Windows\syswow64\explorer.exe")

2014/9/30 13:27:43,C:\Users\250\Desktop

\ba92a58928b82ba662e7abb4ff4014a9\ba92a58928b82ba662e7abb4ff4014a9.exe,40,Blocked ;打开其它

进程并获取修改权限 (explorer.exe(pid=2468))

2014/9/30 13:27:46,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;改变受保护的注册表项目 (HKCU

\Software\Microsoft\Windows\CurrentVersion\Run,54358c)

2014/9/30 13:27:48,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;改变受保护的注册表项目 (HKCU

\Software\Microsoft\Windows\CurrentVersion\RunOnce,*4358c)

2014/9/30 13:27:50,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;改变受保护的注册表项目 (HKCU

\Software\Microsoft\Windows\CurrentVersion\Run,54358cd)

2014/9/30 13:27:52,C:\Windows\SysWOW64\explorer.exe,26,Blocked ;改变受保护的注册表项目 (HKCU

\Software\Microsoft\Windows\CurrentVersion\RunOnce,*4358cd)

2014/9/30 13:27:55,C:\Windows\SysWOW64\explorer.exe,41,Blocked ;修改受保护的文件 (C:\Users

\250\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54358cd.exe)

2014/9/30 13:27:57,C:\Windows\SysWOW64\explorer.exe,53,Allowed ;启动一个应用程序 (-k netsvcs)

2014/9/30 13:28:00,C:\Windows\SysWOW64\explorer.exe,40,Blocked ;打开其它进程并获取修改权限

(svchost.exe(pid=660))

2014/9/30 13:28:06,C:\Windows\SysWOW64\explorer.exe,53,Blocked ;启动一个应用程序 (vssadmin.exe

Delete Shadows /All /Quiet)

2014/9/30 13:28:11,C:\Windows\SysWOW64\svchost.exe,41,Blocked ;修改受保护的文件 (C:\Users

\250\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\54358cd.exe)

2014/9/30 13:28:15,C:\Windows\SysWOW64\svchost.exe,26,Allowed ;改变受保护的注册表项目 (HKCU

\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer)

2014/9/30 13:28:16,C:\Windows\SysWOW64\svchost.exe,50,Allowed ;通过DNS解析服务访问网络

2014/9/30 13:28:20,C:\Windows\SysWOW64\svchost.exe,48,Allowed ;传出的网络访问-出站

Renascence

诺顿21文件智能分析启发杀了

蓝天二号

ESS